Lenny and Team, I just want to throw in a BIG THANK YOU! And sorry for all the stress.
Best and cheers Andreas On Sat, 2026-11-14 at 05:37 +0000, Lenny Primak via user wrote: > Severity: > CVSS 4.0: 9.1 (critical) > CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/A > U:Y/R:U/V:C/RE:L/U:Red > > Affected versions: > > - Apache Shiro (org.apache.shiro:shiro-core) before 3.0.1 > > Description: > > When authentication caching is enabled on DefaultLdapRealm, after a > user logs in successfully once, subsequent logins for that user > succeed with any password. > A cached authentication skips the LDAP bind, and the > AllowAllCredentialsMatcher installed by default in > DefaultLdapRealm accepts any credentials, allowing an attacker who > knows a valid username to authenticate as that user. > This issue affects all Apache Shiro versions through 3.0.0, only when > using DefaultLdapRealm (or JndiLdapRealm) with > authenticationCachingEnabled set to true, which is not the default. > > Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue > by no longer installing AllowAllCredentialsMatcher by default. > Alternatively, disable authentication caching on the LDAP realm (this > is the default), or configure a credentials matcher, such as > SimpleCredentialsMatcher, that verifies credentials against the > cached authentication info. > > Credit: > > Joshua Rogers (finder) > Lenny Primak <[email protected]> (remediation developer) > > References: > > https://shiro.apache.org/ > https://www.cve.org/CVERecord?id=CVE-2026-129349 >
